Apollo Prod Checklist

// src/scripts/prod-checklist.ts
import axios from 'axios';

interface Check { category: string; name: string; pass: boolean; detail: string; }
const results: Check[] = [];

// 1.1 API key is set (not hardcoded)
results.push({
  category: 'Auth', name: 'API key from env/secrets',
  pass: !!process.env.APOLLO_API_KEY,
  detail: process.env.APOLLO_API_KEY ? 'Loaded from env' : 'NOT SET',
});

// 1.2 Using x-api-key header (not query param)
const { execSync } = await import('child_process');
let usesHeader = true;
try { execSync('grep -rn "params.*api_key" src/ --include="*.ts"', { stdio: 'pipe' }); usesHeader = false; } catch {}
results.push({ category: 'Auth', name: 'x-api-key header auth', pass: usesHeader, detail: usesHeader ? 'OK' : 'Switch to x-api-key header' });

// 1.3 API key is valid
try {
  const resp = await axios.get('https://api.apollo.io/api/v1/auth/health', {
    headers: { 'x-api-key': process.env.APOLLO_API_KEY! },
  });
  results.push({ category: 'Auth', name: 'Key valid', pass: resp.data.is_logged_in, detail: resp.data.is_logged_in ? 'OK' : 'Invalid key' });
} catch (err: any) {
  results.push({ category: 'Auth', name: 'Key valid', pass: false, detail: `HTTP ${err.response?.status}` });
}

// 1.4 .env gitignored
const gitIgnored = execSync('git check-ignore .env 2>/dev/null || echo NOT').toString().trim();
results.push({ category: 'Auth', name: '.env gitignored', pass: gitIgnored !== 'NOT', detail: gitIgnored !== 'NOT' ? 'OK' : 'Add .env to .gitignore' });

async function fileContains(dir: string, pattern: string): Promise<boolean> {
  try { execSync(`grep -r "${pattern}" ${dir} --include="*.ts" -l`, { stdio: 'pipe' }); return true; }
  catch { return false; }
}

results.push({ category: 'Resilience', name: 'Rate limiting',
  pass: await fileContains('src/', 'rate-limiter\\|SlidingWindow\\|RateLimit'),
  detail: 'Rate limiter implementation' });

results.push({ category: 'Resilience', name: 'Retry logic',
  pass: await fileContains('src/', 'withRetry\\|withBackoff\\|exponential'),
  detail: 'Exponential backoff for 429/5xx' });

results.push({ category: 'Resilience', name: 'Error categorization',
  pass: await fileContains('src/', 'categorizeError\\|ApolloApiError'),
  detail: 'Typed error handling' });

results.push({ category: 'Resilience', name: 'Timeout configured',
  pass: await fileContains('src/', 'timeout.*\\d'),
  detail: 'Request timeout set' });

results.push({ category: 'Observability', name: 'PII redaction',
  pass: await fileContains('src/', 'redact'),
  detail: 'PII redaction in logs' });

results.push({ category: 'Observability', name: 'Structured logging',
  pass: await fileContains('src/', 'pino\\|winston\\|console\\.log.*Apollo'),
  detail: 'Logger with Apollo context' });

results.push({ category: 'Observability', name: 'Health endpoint',
  pass: await fileContains('src/', '/health'),
  detail: '/health endpoint checking Apollo connectivity' });

results.push({ category: 'Credits', name: 'Credit tracking',
  pass: await fileContains('src/', 'credit\\|CreditTracker'),
  detail: 'Track enrichment credit usage' });

results.push({ category: 'Credits', name: 'Deduplication',
  pass: await fileContains('src/', 'dedup\\|isAlreadyEnriched'),
  detail: 'Prevent duplicate enrichment charges' });

results.push({ category: 'Credits', name: 'Budget controls',
  pass: await fileContains('src/', 'budget\\|isOverBudget'),
  detail: 'Daily credit budget enforcement' });

function generateReport(results: Check[]) {
  const categories = [...new Set(results.map((r) => r.category))];
  let allPass = true;

  console.log('\n  Apollo Production Readiness Checklist\n');

  for (const cat of categories) {
    console.log(`-- ${cat} --`);
    for (const r of results.filter((r) => r.category === cat)) {
      console.log(`  ${r.pass ? 'PASS' : 'FAIL'}  ${r.name}: ${r.detail}`);
      if (!r.pass) allPass = false;
    }
    console.log('');
  }

  const passCount = results.filter((r) => r.pass).length;
  console.log(`Score: ${passCount}/${results.length} checks passed`);
  console.log(`Status: ${allPass ? 'READY FOR PRODUCTION' : 'BLOCKED — fix failing checks'}`);
  process.exit(allPass ? 0 : 1);
}

generateReport(results);

{ "scripts": { "prod:checklist": "tsx src/scripts/prod-checklist.ts" } }

npm run prod:checklist && npm run deploy